Cybersecurity researchers have revealed details of a now-patched vulnerability in Google Chromethat could allow attackers to escalate privileges and gain access to local system files.
The vulnerability, recorded as CVE-2026-0628 (CVSS score: 8.8), has been described as a case of insufficient policy enforcement in the WebView tag. It was patched by Google in early January 2026 in version 143.0.7499.192/.193 for Windows/Mac and 143.0.7499.192 for Linux.
“Insufficient policy enforcement in the WebView tag in Google Chrome before version 143.0.7499.192 allowed an attacker, who convinced a user to install a malicious extension, to inject scripts or HTML into a privileged page via a specially crafted Chrome extension,” according to a description in the NIST National Vulnerabilities Database (NVD).
See also: APT28 linked to MSHTML zero-day ahead of February Patch Tuesday
Google Chrome: Vulnerability also affects Gemini Live dashboard
Palo Alto Networks Unit 42 researcher Gal Weizman , who discovered and reported the vulnerability on November 23, 2025, said the issue could allow malicious extensions with root privileges to take control of the new Gemini Live dashboard in Chrome . The dashboard can be launched by clicking the Gemini icon, located at the top of the browser window.
Google added Gemini integration to Chrome in September 2025. This attack could be used by an attacker to achieve privilege escalation, allowing them to access the victim's camera and microphone without their permission, take screenshots of any web page, and access local files.
The findings highlight an emerging attack vector resulting from the integration of artificial intelligence (AI) and agentic capabilities directly into browsers to facilitate real-time content summarization, translation , and automated task execution, as the same capabilities could be abused to perform privileged actions.
The key issue is that we are giving these AI agents privileged access to perform functions in the browser environment, but this can become a double-edged sword when an attacker secretly embeds prompts into a malicious website, tricking a victim user into visiting it through social engineering or other means. The prompt could instruct the AI assistant to perform actions that would otherwise be blocked by the browser, leading to data extraction or code execution.
See also: Security flaw in Juniper Networks PTX routers
Even worse, the website could manipulate the agent to store instructions in memory, allowing persistence across different sessions. In addition to the expanded attack surface, Unit 42 noted that integrating an AI side panel into agentic browsers brings back classic browser security risks.
“By placing this new component in the browser’s high-privilege context, developers could inadvertently create new logical and implementation weaknesses,” Weizman said. “This could include vulnerabilities related to cross-site scripting (XSS), privilege escalation, and side-channel attacks that can exploit less privileged web pages or browser extensions.”
While browser extensions operate under a defined set of permissions, successful exploitation of CVE-2026-0628 undermines the browser's security model and allows an attacker to execute arbitrary code on “gemini.google[.]com/app” via the browser panel and gain access to sensitive data.
“An extension with access to a basic set of permissions via the declarativeNetRequest allowed permissions that could allow an attacker to inject JavaScript code into the new Gemini panel,” Weizman added. “When the Gemini application is loaded inside this new panel element, Chrome associates it with access to powerful features.”
See also: Trend Micro: Critical vulnerabilities in Apex One
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
It's worth noting that the declarativeNetRequest API allows extensions to intercept and change properties of HTTPS requests and responses. It's used by ad blocking extensions to stop requests from being made to load ads on web pages.
In other words, all an attacker needs to do is trick an unsuspecting user into installing a specially crafted extension, which could then inject arbitrary JavaScript code into the Gemini side panel to interact with the file system, take screenshots, access the camera, and enable the microphone – all of which are necessary for the AI assistant to perform its tasks.
